Skip to contentBouncycastle vulnerabilities
Newest
- bouncycastle bc-javaLDAP filter injection in legacy jdk1.4 LDAPStoreHelperCVE-2026-59652Fix available6.9 Medium
- bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 moreBKS/UBER keystore allocates from untrusted lengths before integrity checkCVE-2026-12185Fix available7.1 High
- bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 moreName Constraints bypass via trailing dot in rfc822Name and URICVE-2026-8763Fix available9.3 Critical
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 morePKCS#8 / PBES2 decryptors honour unbounded KDF cost from inputCVE-2026-15055Fix available5.3 Medium
- bouncycastle bc-javaML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)CVE-2024-14041Fix available8.2 High
- bouncycastle bc-fja, bc-java, bc c .net +2 moreBouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.CVE-2024-29857Fix available7.5 High
- bouncycastle legion-of-the-bouncy-castle-java-crytography-apiBouncy Castle crafted signature and public key can be used to trigger an infinite loopCVE-2024-30172Fix available7.5 High
- bouncycastle bouncy castle for java, netapp active iq unified manager, bluexp +2 more +4 moreBouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")CVE-2024-30171Fix available5.9 Medium
- bouncycastle bouncy castle for java, fips java api +1 moreBouncy Castle Denial of Service (DoS)CVE-2023-33202Fix available5.5 Medium
- bouncycastle bc-javaBouncy Castle For Java LDAP injection vulnerabilityCVE-2023-33201Fix available5.3 Medium
- bouncycastle fips java apiGarbage collection issue in BC-FJA in Java 13 and laterCVE-2022-45146Fix available5.5 Medium
- bouncycastle bc-csharp, bouncy castle fips .net api, fips java api +1 more +3 moreTiming based private key exposure in Bouncy CastleCVE-2020-15522Fix available5.9 Medium
- apache karaf, bouncycastle bc-java, oracle banking corporate lending process management +17 more +19 moreLogic error in Legion of the Bouncy Castle BC JavaCVE-2020-28052Public exploitFix available8.1 High
- bouncycastle fips java api, legion-of-the-bouncy-castle +1 moreObservable Differences in Behavior to Error Inputs in Bouncy CastleCVE-2020-26939Fix available5.3 Medium
- apache tomee, bouncycastle bc-java, netapp active iq unified manager +18 more +20 moreOut-of-Memory Error in Bouncy Castle CryptoCVE-2019-17359Fix available7.5 High
- bouncycastle bc-java, netapp oncommand workflow automation, opensuse leap +21 more +23 moreDeserialization of Untrusted Data in Bouncy castleCVE-2018-1000613Fix available9.8 Critical
- bouncycastle bc-java, fips java api, debian linux +17 more +19 moreBouncy Castle has a flaw in the Low-level interface to RSA key pair generatorCVE-2018-1000180Fix available7.5 High
- bouncycastle bc-javaIn Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB modeCVE-2016-1000352Fix available7.4 High
- bouncycastle bc-javaIn Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB modeCVE-2016-1000344Fix available7.4 High
- bouncycastle bc-javaThe Bouncy Castle JCE Provider carry a propagation bugCVE-2016-1000340Fix available7.5 High
- bouncycastle bc-java, debian linux +1 moreIn Bouncy Castle JCE Provider the other party DH public key is not fully validatedCVE-2016-1000346Fix available3.7 Low
- bouncycastle bc-java, debian linux +1 moreModerate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15CVE-2016-1000345Fix available5.9 Medium
- bouncycastle bc-java, debian linux +1 moreIn Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default valuesCVE-2016-1000343Fix available7.5 High
- bouncycastle bc-java, debian linux +1 moreIn Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verificationCVE-2016-1000342Fix available7.5 High
- bouncycastle bc-java, debian linux +1 moreModerate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15CVE-2016-1000341Fix available5.9 Medium
- bouncycastle bc-java, debian linux +1 moreModerate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15CVE-2016-1000339Fix available5.3 Medium
- bouncycastle legion-of-the-bouncy-castle-java-crytography-api, canonical ubuntu linux, netapp 7-mode transition tool +2 more +4 moreIn Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validateCVE-2016-1000338Fix available7.5 High
- legion of the bouncy castle bouncy castle, bouncycastle bc-java, redhat satellite +1 more +3 moreBouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisionsCVE-2018-5382Fix available4.4 Medium
- legion of the bouncy castle bouncycastle tls, bouncycastle bc-java +1 moreBouncyCastle JCE TLS Bleichenbacher/ROBOTCVE-2017-13098Fix availableEPSS 24.3%7.5 High
- google android, bouncycastle bc-java +1 more** DISPUTED ** The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends...CVE-2016-2427Disputed5.5 Medium
- bouncycastle bouncy castle crypto package, opensuse leap, opensuse +4 more +6 moreModerate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15CVE-2015-7940Fix available5.0 Medium
- bouncycastle bc-java, legion-of-the-bouncy-castle-c\#-cryptography-api +1 moreImproper Input Validation in Bouncy CastleCVE-2013-1624Fix available4.0 Medium
- bouncycastle bc-java, bouncy-castle-crypto-package +1 moreLegion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle VulnerabilityCVE-2007-6721Fix available10.0 High